29.17. Apache in a chroot jail

This part focuses on preventing Apache from being used as a point of break-in to the system hosting it. Apache by default runs as a non-root user, which will limit any damage to what can be done as a normal user with a local shell. Of course, allowing what amounts to an anonymous guest account falls rather short of the security requirements for most Apache servers, so an additional step can be taken - that is, running Apache in a chroot jail.

The main benefit of a chroot jail is that the jail will limit the portion of the file system the daemon can see to the root directory of the jail. Additionally, since the jail only needs to support Apache, the programs available in the jail can be extremely limited. Most importantly, there is no need for setuid-root programs, which can be used to gain root access and break out of the jail.

Chrooting apache is no easy task and has a tendency to break things. Before we embark on this, we need to first decide whether it is beneficial for you to do so. Some pros and cons are there, but most certainly not limited to, the following:

The chrooted configuration listed below supposes that you've compiled your Apache server with the external program mod_ssl. The differences in what you've compiled with your Apache web server reside in which libraries and binaries you'll need to copy to the chrooted directory.

The following are the necessary steps to run Apache Web Server in a chroot jail:

We must find the shared library dependencies of httpd. These will need to be copied into the chroot jail later. To find the shared library dependencies of httpd, execute the following command:

          [root@deep ]/# ldd /usr/sbin/httpd
        

          libpam.so.0 =>/lib/libpam.so.0 (0x40016000)
          libm.so.6 =>/lib/libm.so.6 (0x4001f000)
          libdl.so.2 =>/lib/libdl.so.2 (0x4003b000)
          libcrypt.so.1 =>/lib/libcrypt.so.1 (0x4003e000)
          libnsl.so.1 =>/lib/libnsl.so.1 (0x4006b000)
          libresolv.so.2 =>/lib/libresolv.so.2 (0x40081000)
          libdb.so.3 =>/lib/libdb.so.3 (0x40090000)
          libc.so.6 =>/lib/libc.so.6 (0x400cb000)
          /lib/ld-linux.so.2 =>/lib/ld-linux.so.2 (0x40000000)
        

Add a new UID and a new GID if this is not already done for running Apache httpd. This is important because running it as root defeats the purpose of the jail, and using a different UID that already exists on the system i.e. nobody can allow your services to access each others' resources. Consider the scenario where a web server is running as nobody, or any other overly used UID/GID and compromised. The cracker can now access any other processes running as nobody from within the chroot.